Live › vulnerability › CVE-2026-118568
Drupal Content Sync stores sensitive information in an insecure way, so data embedded in exported content can be retrieved. The sources do not say what the data is or what access an attacker needs to read it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the Content Sync module (content-sync.io) at version 3.2.2 or earlier are in scope. The sources do not say which configuration or data path exposes the embedded sensitive data, so teams should confirm whether their exported content holds secrets before ruling themselves out.
No product ranges from the sources yet.
drush pm:list --filter=content_sync on a Drupal site.composer.lock file and note the drupal/content_sync version.3.2.2 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-118568")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.